It's now possible to find the AWS Account ID for any S3 Bucket (private too)

Re:It's now possible to find the AWS Account ID for any S3 B... by jameshart on Monday February 26, 2024 @01:37PM (#39515130)

My general assumption is not that they’re random, but at least that they’re not correlated; in particular that Amazon is not in the habit of handing out, like, account IDs 676363687000 - 676363687999 to a single organization. Even if they did hand out a sequential batch of 1000 account IDs, it would be more likely to be 676363687541 - 676363688540 than a set with a single consistent prefix.

Odds are that an account wildcard match like 676363687* will just match a few hundred entirely random AWS accounts.

[ Parent | on HN ]

Re:It's now possible to find the AWS Account ID for any S3 B... by naniwaduni on Monday February 26, 2024 @04:17PM (#39516864)

> in particular that Amazon is not in the habit of handing out, like, account IDs 676363687000 - 676363687999 to a single organization

Honestly, wouldn't surprise me that much if they were willing to accommodate this if for sufficiently large accounts. It'd still pretty sketchy to design your access control around, but it wouldn't be unrealistic.

[ Parent | on HN ]

Re:It's now possible to find the AWS Account ID for any S3 B... by dpedu on Monday February 26, 2024 @03:41PM (#39516530)

I once was involved in creating two (linked) amazon accounts at the "same" time, and ended up with account IDs of which the first 4 digits are identical.

[ Parent | on HN ]

Re:It's now possible to find the AWS Account ID for any S3 B... by jameshart on Monday February 26, 2024 @06:46PM (#39518288)

A namespace you and only 100 million other accounts share - probably reasonable to just grant access to “1234*”.

[ Parent | on HN ]